@axiom-lattice/gateway 2.1.101 → 2.1.103

package/src/controllers/resources.ts

@@ -0,0 +1,299 @@
+import { FastifyRequest, FastifyReply } from "fastify";
+import type { ResourceAddress, SharedResourceStore } from "@axiom-lattice/protocols";
+import bcrypt from "bcryptjs";
+import {
+  generateToken,
+  createSharePayload,
+  TokenCache,
+  SandboxLatticeManager,
+} from "@axiom-lattice/core";
+import { getContentTypeFromFilename } from "../utils/mime";
+
+interface ResourceControllerDeps {
+  store: SharedResourceStore;
+  sandboxManager: SandboxLatticeManager;
+  cache: TokenCache;
+  logger: { info: (msg: string, obj?: object) => void; warn: (msg: string, obj?: object) => void; error: (msg: string, obj?: object) => void };
+}
+
+export class ResourceController {
+  constructor(private deps: ResourceControllerDeps) {}
+
+  async createShare(request: FastifyRequest, reply: FastifyReply) {
+    const userId = (request as any).user
+      ? (request as any).user.id ?? "unknown"
+      : "unknown";
+    const tenantId = (request.headers["x-tenant-id"] as string) || "default";
+    const workspaceId = request.headers["x-workspace-id"] as string;
+    const projectId = request.headers["x-project-id"] as string;
+    const body = request.body as any;
+
+    if (!workspaceId || !projectId) {
+      return reply.status(400).send({ error: "x-workspace-id and x-project-id headers required" });
+    }
+
+    const payload = createSharePayload(
+      tenantId,
+      workspaceId,
+      projectId,
+      userId as string,
+      body,
+    );
+    const token = generateToken();
+
+    try {
+      await this.deps.store.create({ ...payload, token });
+      this.deps.logger.info(
+        "[share] created",
+        { token, originalPath: body.resourcePath, normalizedPath: payload.address.resourcePath, volume: payload.address.volume, userId },
+      );
+    } catch {
+      return reply.status(500).send({ error: "Failed to create share" });
+    }
+
+    return reply.status(201).send({ token, url: `/s/${token}` });
+  }
+
+  async listShares(request: FastifyRequest, reply: FastifyReply) {
+    const userId = (request as any).user
+      ? (request as any).user.id ?? "unknown"
+      : "unknown";
+    const tenantId = (request.headers["x-tenant-id"] as string) || "default";
+    const shares = await this.deps.store.listByUser(tenantId, userId as string);
+    return reply.send(shares);
+  }
+
+  async updateShare(request: FastifyRequest, reply: FastifyReply) {
+    const { token } = request.params as unknown as { token: string };
+    const userId = (request as any).user
+      ? (request as any).user.id as string
+      : undefined;
+    const patch = request.body as any;
+
+    const record = await this.deps.store.findByToken(token);
+    if (!record || record.createdBy !== userId) {
+      return reply.status(404).send({ error: "Share not found" });
+    }
+
+    await this.deps.store.update(token, patch);
+
+    if (patch.revoked) {
+      this.deps.cache.invalidate(token);
+    }
+
+    return reply.send({ ok: true });
+  }
+
+  async revokeShare(request: FastifyRequest, reply: FastifyReply) {
+    const { token } = request.params as unknown as { token: string };
+    const userId = (request as any).user
+      ? (request as any).user.id as string
+      : undefined;
+
+    const record = await this.deps.store.findByToken(token);
+    if (!record || record.createdBy !== userId) {
+      return reply.status(404).send({ error: "Share not found" });
+    }
+
+    await this.deps.store.update(token, { revoked: true });
+    this.deps.cache.invalidate(token);
+
+    return reply.send({ ok: true });
+  }
+
+  async resolveResource(request: FastifyRequest, reply: FastifyReply) {
+    const params = request.params as unknown as { token: string; "*"?: string };
+    const { token } = params;
+    const subPath = params["*"] ?? "";
+
+    this.deps.logger.info("[share] resolve start", { token, subPath });
+
+    // 1. Check cache
+    const cached = this.deps.cache.get(token);
+    if (cached && !cached.requiresUnlock) {
+      this.deps.logger.info("[share] cache hit", { token, volume: cached.address.volume, resourcePath: cached.address.resourcePath });
+      return this._serveFile(cached.address, token, subPath, cached.sandboxConfig ?? { tenantId: "default", workspaceId: "", projectId: "", assistantId: null }, reply);
+    }
+    this.deps.logger.info("[share] cache miss, querying DB", { token });
+
+    // 2. Single DB lookup
+    const record = await this.deps.store.findByToken(token);
+    if (!record || record.revoked) {
+      this.deps.logger.warn("[share] token not found or revoked", { token, found: !!record, revoked: record?.revoked });
+      return reply.status(404).send("Not found");
+    }
+    if (record.expiresAt && new Date(record.expiresAt) < new Date()) {
+      this.deps.logger.info("[share] token expired", { token, expiresAt: record.expiresAt });
+      return reply.status(410).send("Expired");
+    }
+
+    this.deps.logger.info("[share] record found", {
+      token,
+      volume: record.address.volume,
+      resourcePath: record.address.resourcePath,
+      visibility: record.visibility,
+      workspaceId: record.workspaceId,
+      projectId: record.projectId,
+    });
+
+    // 3. Auth
+    const isInternal = this._isInternalRequest(request);
+    if (!isInternal) {
+      if (record.visibility === "password") {
+        const unlocked = this._isUnlocked(request, token);
+        if (!unlocked) {
+          this.deps.logger.info("[share] password protected, returning password page", { token });
+          this.deps.cache.set(token, {
+            address: record.address,
+            requiresUnlock: true,
+            sandboxConfig: { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId },
+          });
+          return reply.type("text/html").send(this._passwordPage(token));
+        }
+        this.deps.logger.info("[share] password unlocked", { token });
+      }
+    }
+
+    // 4. Access count
+    if (record.maxAccess !== null) {
+      const ok = await this.deps.store.atomicIncrementAccess(token);
+      if (!ok) return reply.status(410).send("Access limit reached");
+    } else {
+      this.deps.store.incrementAccess(token).catch(() => {});
+    }
+
+    // 5. Cache
+    const sandboxConfig = { tenantId: record.tenantId, workspaceId: record.workspaceId, projectId: record.projectId, assistantId: record.assistantId };
+    this.deps.cache.set(token, {
+      address: record.address,
+      requiresUnlock: record.visibility === "password" && !isInternal,
+      sandboxConfig,
+    });
+
+    return this._serveFile(record.address, token, subPath, sandboxConfig, reply);
+  }
+
+  async unlockShare(request: FastifyRequest, reply: FastifyReply) {
+    const { token } = request.params as unknown as { token: string };
+    const { password } = request.body as unknown as { password: string };
+
+    const record = await this.deps.store.findByToken(token);
+    if (!record || !record.passwordHash) {
+      return reply.status(404).send({ error: "Invalid request" });
+    }
+
+    // Plain text comparison for now — bcrypt will come in Task 12
+    const valid = await bcrypt.compare(password, record.passwordHash!);
+    if (!valid) {
+      return reply.status(401).send({ error: "Incorrect password" });
+    }
+
+    reply.header(
+      "Set-Cookie",
+      `share_unlock_${token}=1; Max-Age=86400; Path=/s/${token}; SameSite=Lax; HttpOnly; Secure`,
+    );
+    return reply.send({ ok: true });
+  }
+
+  private _isInternalRequest(request: FastifyRequest): boolean {
+    // Check for valid user session from auth middleware
+    const user = (request as any).user;
+    return !!user && !!user.id;
+  }
+
+  private _isUnlocked(request: FastifyRequest, token: string): boolean {
+    const cookie = request.headers.cookie ?? "";
+    return cookie.includes(`share_unlock_${token}=1`);
+  }
+
+  private async _serveFile(
+    address: ResourceAddress,
+    token: string,
+    subPath: string,
+    sandboxConfig: { tenantId: string; workspaceId: string; projectId: string; assistantId: string | null },
+    reply: FastifyReply,
+  ) {
+    const provider = this.deps.sandboxManager.getDefaultProvider();
+    const resolver = provider.getResourceResolver();
+    const sandboxPath = subPath
+      ? this._resolveSafeSubPath(address.resourcePath, subPath)
+      : address.resourcePath;
+
+    this.deps.logger.info("[share] serving file", {
+      token, volume: address.volume, sandboxPath, subPath: subPath || "(none)",
+      tenantId: sandboxConfig.tenantId, workspaceId: sandboxConfig.workspaceId, projectId: sandboxConfig.projectId,
+    });
+
+    let buf: Buffer;
+    try {
+      // Try volume FS first
+      buf = await resolver.resolve({ ...address, resourcePath: sandboxPath });
+      this.deps.logger.info("[share] resolved via volume FS", { token, size: buf.length });
+    } catch (err) {
+      this.deps.logger.warn("[share] volume FS failed, trying sandbox fallback", {
+        token, path: sandboxPath, error: (err as Error).message,
+      });
+      try {
+        const sandbox = await this.deps.sandboxManager.getSandboxFromConfig({
+          assistant_id: sandboxConfig.assistantId ?? "",
+          thread_id: "",
+          tenantId: sandboxConfig.tenantId,
+          workspaceId: sandboxConfig.workspaceId,
+          projectId: sandboxConfig.projectId,
+        });
+        buf = await sandbox.file.downloadFile({ file: `/project/${sandboxPath}` });
+        this.deps.logger.info("[share] resolved via sandbox fallback", { token, size: buf.length });
+      } catch (err) {
+        this.deps.logger.warn("[share] all resolution attempts failed", { token, resourcePath: sandboxPath, error: (err as Error).message });
+        return reply.status(404).send("File not found");
+      }
+    }
+
+    const fullPath = sandboxPath;
+
+    const filename = fullPath.split("/").pop() || "download";
+    const isHtml = !subPath && /\.(html|htm)$/i.test(filename);
+
+    if (isHtml) {
+      buf = this._injectBaseTag(buf, token);
+    }
+
+    const contentType = getContentTypeFromFilename(filename);
+
+    return reply
+      .status(200)
+      .type(contentType)
+      .header("Content-Disposition", `inline; filename="${filename}"`)
+      .header("Access-Control-Allow-Origin", "*")
+      .send(buf);
+  }
+
+  private _resolveSafeSubPath(entryFile: string, subPath: string): string {
+    if (!subPath) return entryFile;
+    if (subPath.includes("..")) throw new Error("Path traversal denied");
+    const entryDir = entryFile.replace(/[^/]+$/, "");
+    return (entryDir + subPath).replace(/\/+/g, "/");
+  }
+
+  private _injectBaseTag(buf: Buffer, token: string): Buffer {
+    const html = buf.toString("utf-8");
+    if (/<base\b/i.test(html)) return buf;
+    const baseTag = `<base href="/s/${token}/">`;
+    if (html.includes("</head>")) {
+      return Buffer.from(html.replace("</head>", `${baseTag}</head>`), "utf-8");
+    }
+    // No </head> — insert after <head> or <html> or after <!doctype>
+    if (html.includes("<head>")) {
+      return Buffer.from(html.replace("<head>", `<head>${baseTag}`), "utf-8");
+    }
+    if (html.includes("<html>")) {
+      return Buffer.from(html.replace("<html>", `<html>${baseTag}`), "utf-8");
+    }
+    // Fallback: prepend (will be after <!doctype> if present since html starts with <!doctype)
+    return Buffer.from(baseTag + html, "utf-8");
+  }
+
+  private _passwordPage(token: string): string {
+    return `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Password Protected</title><style>body{font-family:-apple-system,BlinkMacSystemFont,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#f5f5f5}.card{background:#fff;padding:32px;border-radius:12px;box-shadow:0 2px 8px rgba(0,0,0,.1);width:100%;max-width:360px;text-align:center}h2{margin:0 0 8px;font-size:20px}p{margin:0 0 20px;color:#666;font-size:14px}input{width:100%;padding:10px 12px;border:1px solid #d9d9d9;border-radius:8px;font-size:14px;box-sizing:border-box;margin-bottom:12px}button{width:100%;padding:10px;background:#6366f1;color:#fff;border:none;border-radius:8px;font-size:14px;cursor:pointer}.error{color:#ef4444;font-size:13px;margin-top:8px;display:none}</style></head><body><div class="card"><h2>Password Protected</h2><p>This share requires a password to access.</p><form id="f"><input type="password" id="p" placeholder="Enter password" required><button type="submit">Unlock</button><div class="error" id="e">Incorrect password</div></form></div><script>document.getElementById('f').onsubmit=async(e)=>{e.preventDefault();const r=await fetch('/s/${token}/unlock',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({password:document.getElementById('p').value})});if(r.ok)location.reload();else document.getElementById('e').style.display='block'}</script></body></html>`;
+  }
+}

package/src/controllers/sandbox.ts

@@ -1,36 +1,7 @@
 import { FastifyInstance } from "fastify";
 import { sandboxService } from "../services/sandbox_service";
 import { getSandBoxManager } from "@axiom-lattice/core";
-
-/** Get filename from path (e.g. /home/gem/uploads/foo.pdf -> foo.pdf) */
-function getFilenameFromPath(path: string): string {
-  const segments = path.replace(/\/+$/, "").split("/");
-  return segments[segments.length - 1] || "download";
-}
-
-/** Common extension -> MIME type for download response */
-const EXT_TO_MIME: Record<string, string> = {
-  ".txt": "text/plain",
-  ".html": "text/html",
-  ".css": "text/css",
-  ".js": "application/javascript",
-  ".json": "application/json",
-  ".pdf": "application/pdf",
-  ".png": "image/png",
-  ".jpg": "image/jpeg",
-  ".jpeg": "image/jpeg",
-  ".gif": "image/gif",
-  ".webp": "image/webp",
-  ".svg": "image/svg+xml",
-  ".zip": "application/zip",
-  ".csv": "text/csv",
-  ".xml": "application/xml",
-};
-
-function getContentTypeFromFilename(filename: string): string {
-  const ext = filename.includes(".") ? filename.slice(filename.lastIndexOf(".")).toLowerCase() : "";
-  return EXT_TO_MIME[ext] ?? "application/octet-stream";
-}
+import { getContentTypeFromFilename, getFilenameFromPath } from "../utils/mime";
 
 interface SandboxParams {
   assistantId: string;

package/src/controllers/workspace.ts

@@ -12,6 +12,7 @@ import { getStoreLattice } from "@axiom-lattice/core";
 import { SandboxFilesystem, FilesystemBackend } from "@axiom-lattice/core";
 import { getSandBoxManager } from "@axiom-lattice/core";
 import { v4 as uuidv4 } from "uuid";
+import { getContentTypeFromFilename, getFilenameFromPath } from "../utils/mime";
 import type {
   CreateWorkspaceRequest,
   UpdateWorkspaceRequest,
@@ -301,34 +302,6 @@ export class WorkspaceController {
     }
   }
 
-  private getFilenameFromPath(filePath: string): string {
-    const segments = filePath.split("/");
-    return segments[segments.length - 1] || "download";
-  }
-
-  private getMimeType(filename: string): string {
-    const ext = filename.split(".").pop()?.toLowerCase() || "";
-    const mimeTypes: Record<string, string> = {
-      pdf: "application/pdf",
-      csv: "text/csv",
-      xlsx: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
-      xls: "application/vnd.ms-excel",
-      txt: "text/plain",
-      json: "application/json",
-      png: "image/png",
-      jpg: "image/jpeg",
-      jpeg: "image/jpeg",
-      gif: "image/gif",
-      svg: "image/svg+xml",
-      html: "text/html",
-      htm: "text/html",
-      mp3: "audio/mpeg",
-      mp4: "video/mp4",
-      webm: "video/webm",
-    };
-    return mimeTypes[ext] || "application/octet-stream";
-  }
-
   private isBinaryContentType(filename: string): boolean {
     const ext = filename.split(".").pop()?.toLowerCase() || "";
     const binaryExtensions = new Set([
@@ -370,7 +343,7 @@ export class WorkspaceController {
           projectId,
         };
 
-        const filename = this.getFilenameFromPath(resolvedPath);
+        const filename = getFilenameFromPath(resolvedPath);
         const isBinary = this.isBinaryContentType(filename);
 
         // Use volume backend when available; fall back to sandbox
@@ -389,7 +362,7 @@ export class WorkspaceController {
           buf = await sandbox.file.downloadFile({ file: resolvedPath });
         }
 
-        const inferredContentType = this.getMimeType(filename);
+        const inferredContentType = getContentTypeFromFilename(filename);
 
         const contentDisposition = `attachment; filename*=UTF-8''${encodeURIComponent(filename)}`;
         return reply.status(200).type(inferredContentType).header("Content-Disposition", contentDisposition).send(buf);
@@ -397,8 +370,8 @@ export class WorkspaceController {
 
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
       const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = this.getFilenameFromPath(resolvedPath);
-      const mimeType = this.getMimeType(filename);
+      const filename = getFilenameFromPath(resolvedPath);
+      const mimeType = getContentTypeFromFilename(filename);
       const buffer = Buffer.from(content, "utf-8");
 
       return reply
@@ -446,7 +419,7 @@ export class WorkspaceController {
           projectId,
         };
 
-        const filename = this.getFilenameFromPath(resolvedPath);
+        const filename = getFilenameFromPath(resolvedPath);
         const isBinary = this.isBinaryContentType(filename);
 
         // Use volume backend when available; fall back to sandbox
@@ -465,7 +438,7 @@ export class WorkspaceController {
           buf = await sandbox.file.downloadFile({ file: resolvedPath });
         }
 
-        const inferredContentType = this.getMimeType(filename);
+        const inferredContentType = getContentTypeFromFilename(filename);
 
         try {
           const contentType = inferredContentType;
@@ -510,8 +483,8 @@ export class WorkspaceController {
 
       const { backend } = await this.getBackend(tenantId, workspaceId, projectId, assistantId, resolvedPath);
       const content = await backend.read(resolvedPath, 0, Infinity);
-      const filename = this.getFilenameFromPath(resolvedPath);
-      const mimeType = this.getMimeType(filename);
+      const filename = getFilenameFromPath(resolvedPath);
+      const mimeType = getContentTypeFromFilename(filename);
 
       // Inject AI2APP context script for HTML files
       let finalContent = content;

package/src/index.ts

@@ -7,6 +7,7 @@ import staticPlugin from "@fastify/static";
 import path from "path";
 import { fileURLToPath } from "url";
 import { registerLatticeRoutes } from "./routes";
+import { registerResourceRoutes } from "./routes/resource-routes";
 import type { ChannelInstallationStore, BindingRegistry } from "@axiom-lattice/protocols";
 import { MessageRouter } from "./router/MessageRouter";
 import { ChannelAdapterRegistry } from "./channels/registry";
@@ -30,6 +31,7 @@ import {
   agentInstanceManager,
   createSandboxProvider,
   type CreateSandboxProviderConfig,
+  TokenCache,
 } from "@axiom-lattice/core";
 import {
   LoggerType,
@@ -126,6 +128,9 @@ app.addHook("preHandler", async (request, reply) => {
   // Public routes don't require authentication
   if (PUBLIC_ROUTES.some((r) => request.url === r)) return;
 
+  // Public resource shares — /s/:token and /s/:token/*
+  if (request.url.startsWith("/s/")) return;
+
   // Allow direct URL access for iframe endpoints (viewfile, downloadfile)
   // These carry tenant context via query params and are accessed by iframes
   const urlPath = request.url.split("?")[0];
@@ -351,6 +356,25 @@ const start = async (config?: LatticeGatewayConfig) => {
       logger.info("Registered sandbox manager from env configuration");
     }
 
+    // Initialize resource share controller
+    try {
+      const { ResourceController } = await import("./controllers/resources");
+      const sharedResourceStore = getStoreLattice("default", "sharedResource").store;
+      const cache = new TokenCache();
+      const resourceController = new ResourceController({
+        store: sharedResourceStore,
+        sandboxManager: sandboxLatticeManager,
+        cache,
+        logger,
+      });
+      registerResourceRoutes(app, resourceController);
+      logger.info("Resource share routes registered");
+    } catch (err) {
+      logger.warn("Resource share infrastructure unavailable", {
+        error: err instanceof Error ? err.message : String(err),
+      });
+    }
+
     // Connect all enabled channel installations
     if (channelDeps && process.env.CHANNELS_ENABLED !== "false") {
       const { connectAllChannels } = await import("@axiom-lattice/core");

package/src/routes/resource-routes.ts

@@ -0,0 +1,24 @@
+import { FastifyInstance } from "fastify";
+import { ResourceController } from "../controllers/resources";
+
+export function registerResourceRoutes(
+  app: FastifyInstance,
+  controller: ResourceController
+) {
+  // Public share access — MUST be before /api/** wildcard routes
+  app.get("/s/:token", controller.resolveResource.bind(controller));
+  app.get("/s/:token/*", controller.resolveResource.bind(controller));
+  app.post("/s/:token/unlock", controller.unlockShare.bind(controller));
+  app.options("/s/:token", async (_req, reply) => {
+    reply.header("Access-Control-Allow-Origin", "*");
+    reply.header("Access-Control-Allow-Methods", "GET, OPTIONS, POST");
+    reply.header("Access-Control-Allow-Headers", "Content-Type");
+    return reply.status(204).send();
+  });
+
+  // Management API
+  app.post("/api/resources/share", controller.createShare.bind(controller));
+  app.get("/api/resources/shares", controller.listShares.bind(controller));
+  app.patch("/api/resources/share/:token", controller.updateShare.bind(controller));
+  app.delete("/api/resources/share/:token", controller.revokeShare.bind(controller));
+}

package/src/utils/mime.ts

@@ -0,0 +1,43 @@
+const EXT_TO_MIME: Record<string, string> = {
+  ".txt": "text/plain",
+  ".html": "text/html",
+  ".htm": "text/html",
+  ".css": "text/css",
+  ".js": "application/javascript",
+  ".mjs": "application/javascript",
+  ".json": "application/json",
+  ".pdf": "application/pdf",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".svg": "image/svg+xml",
+  ".ico": "image/x-icon",
+  ".zip": "application/zip",
+  ".csv": "text/csv",
+  ".xml": "application/xml",
+  ".xlsx": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  ".xls": "application/vnd.ms-excel",
+  ".pptx": "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  ".ppt": "application/vnd.ms-powerpoint",
+  ".docx": "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  ".doc": "application/msword",
+  ".mp4": "video/mp4",
+  ".webm": "video/webm",
+  ".mp3": "audio/mpeg",
+  ".wav": "audio/wav",
+  ".ogg": "audio/ogg",
+};
+
+export function getContentTypeFromFilename(filename: string): string {
+  const ext = filename.includes(".")
+    ? filename.slice(filename.lastIndexOf(".")).toLowerCase()
+    : "";
+  return EXT_TO_MIME[ext] ?? "application/octet-stream";
+}
+
+export function getFilenameFromPath(path: string): string {
+  const segments = path.replace(/\/+$/, "").split("/");
+  return segments[segments.length - 1] || "download";
+}